From 2d2a45751707e0a36b16d15afed676c7574f1329 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Sat, 10 Jul 2021 13:01:59 -0500 Subject: [PATCH 1/2] fix pool scanners on some windows versions This fixes the size of _POOL_HEADER on 32-bit versions of Windows (was 16, should be 8). Also, get_object() is not doing enough validation and its returning too early. I turned that into a generator so it yields both valid and invalid objects, since the caller does validation anyway. Another way of fixing this is to pass the type_map and cookie from the caller into get_object() so it can do the proper validation and only return valid objects. --- volatility3/framework/symbols/windows/extensions/pool.py | 7 +++---- volatility3/framework/symbols/windows/poolheader-x86.json | 2 +- volatility3/plugins/windows/poolscanner.py | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 5353fc30b..79d03fcc2 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -59,7 +59,7 @@ class POOL_HEADER(objects.StructType): layer_name = self.vol.layer_name, offset = self.vol.offset + pool_header_size, native_layer_name = native_layer_name) - return mem_object + yield mem_object # otherwise we have an executive object in the pool else: @@ -145,7 +145,7 @@ class POOL_HEADER(objects.StructType): native_layer_name = native_layer_name) if mem_object.is_valid(): - return mem_object + yield mem_object except (TypeError, exceptions.InvalidAddressException): pass @@ -168,8 +168,7 @@ class POOL_HEADER(objects.StructType): if mem_object.is_valid(): return mem_object except (TypeError, exceptions.InvalidAddressException): - return None - return None + pass @classmethod @functools.lru_cache() diff --git a/volatility3/framework/symbols/windows/poolheader-x86.json b/volatility3/framework/symbols/windows/poolheader-x86.json index d117a8b2c..72f2c6cc1 100644 --- a/volatility3/framework/symbols/windows/poolheader-x86.json +++ b/volatility3/framework/symbols/windows/poolheader-x86.json @@ -55,7 +55,7 @@ } }, "kind": "struct", - "size": 16 + "size": 8 } }, "symbols": { diff --git a/volatility3/plugins/windows/poolscanner.py b/volatility3/plugins/windows/poolscanner.py index 951edac66..4885c88d7 100644 --- a/volatility3/plugins/windows/poolscanner.py +++ b/volatility3/plugins/windows/poolscanner.py @@ -121,7 +121,7 @@ class PoolScanner(plugins.PluginInterface): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + architectures = ["Intel32", "Intel64"]), requirements.PluginRequirement(name = 'handles', plugin = handles.Handles, version = (1, 0, 0)), ] From ea335b03aeb28c20337aa62c6188cb7ad958cdd4 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Mon, 12 Jul 2021 08:36:38 -0500 Subject: [PATCH 2/2] change return to yield after get_object() turned into a generator in 2da510d8 --- volatility3/framework/symbols/windows/extensions/pool.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 79d03fcc2..f75c6c417 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -166,7 +166,7 @@ class POOL_HEADER(objects.StructType): try: if mem_object.is_valid(): - return mem_object + yield mem_object except (TypeError, exceptions.InvalidAddressException): pass